Description

Detects the use of cryptographically weak cipher algorithms in Java applications through KeyGenerator.getInstance() calls. Using weak cipher algorithms can expose the application to cryptographic attacks, potentially compromising encrypted data.

Detection Strategy

• Identifies calls to KeyGenerator.getInstance() methods in Java code, including fully qualified and shortened versions

• Examines the first argument passed to getInstance() which specifies the cipher algorithm

• Evaluates if the specified cipher algorithm is considered cryptographically weak or insecure

• Reports a vulnerability when an insecure cipher algorithm is detected in the getInstance() parameter

Vulnerable code example

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;
import javax.crypto.KeyGenerator;

public class InsecureCrypto {
    public static void main(String[] args) throws Exception {
        // Using DES - a weak encryption algorithm...

✅ Secure code example

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import java.security.MessageDigest;
import javax.crypto.spec.IvParameterSpec;
import java.security.SecureRandom;

public class SecureCrypto {...